Billion-record stolen Chinese database for sale on breach forum

Re:Billion-record stolen Chinese database for sale on breach... by robonerd on Tuesday July 05, 2022 @03:28PM (#31992615)

Keeping secrets in environmental variables has always seemed dodgy to me. Unless specifically cleared, they get inherited by all child processes. Maybe there are never any child processes in your application, or that could be desired behavior in some circumstances, but generally it seems like asking for trouble.

[ Parent | on HN ]

Re:Billion-record stolen Chinese database for sale on breach... by toomuchtodo on Tuesday July 05, 2022 @03:42PM (#31992755)

Its safety is proportional to your isolation model. Never use env vars for secrets when you’re executing arbitrary code, for example.

[ Parent | on HN ]

Re:Billion-record stolen Chinese database for sale on breach... by RajT88 on Tuesday July 05, 2022 @05:24PM (#31993906)

There's also the reverse issue - if they change after your process is started.

Refreshing an environment variable that has changed is (for me) a line I won't cross. Time to write the app a different way, once that becomes a concern.

[ Parent | on HN ]